CEH Practice Question: Malware, Social Engineering and Network Attacks
A security analyst notices an unusual spike in outbound traffic on UDP port 53 from a single internal host. The host is not a DNS server. Which type of malware is MOST likely responsible?
⚠ Common exam trap
The trap here is that candidates may associate any unusual outbound traffic with a generic malware type (like a worm or virus) rather than recognizing the specific protocol and port combination (UDP 53) as a classic indicator of DNS tunneling for data exfiltration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A DNS tunneling tool used for data exfiltration
DNS tunneling encapsulates non-DNS traffic (e.g., data exfiltration) within DNS queries and responses, typically using UDP port 53. Since the host is not a DNS server, the outbound spike on port 53 indicates it is likely tunneling data to an external command-and-control server, making option C correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A worm that spreads via email attachments
Why it's wrong here
A worm spreading via email attachments primarily utilizes SMTP (port 25) for outbound email transmission to propagate itself to new victims. While it might initiate HTTP or SMB connections to download additional payloads or communicate with a command-and-control server, its core spreading mechanism does not involve a significant spike in outbound DNS (UDP port 53) traffic. Therefore, this type of malware would not be the primary cause of the observed DNS traffic anomaly.
- ✗
A polymorphic virus
Why it's wrong here
A polymorphic virus is designed to evade signature-based detection by altering its internal code structure with each infection, making it appear unique. This obfuscation technique primarily affects the virus's executable footprint and its ability to bypass antivirus scans. However, the act of polymorphism itself does not inherently generate an unusual spike in outbound DNS traffic, as its core function is code mutation, not network communication via DNS for data transfer or command and control.
- ✓
A DNS tunneling tool used for data exfiltration
Why this is correct
DNS tunneling is a sophisticated data exfiltration technique where malicious actors encode arbitrary data within DNS queries and responses, effectively creating a covert communication channel. This method leverages the legitimate and often unfiltered nature of DNS traffic (UDP port 53) to bypass firewalls and intrusion detection systems. A significant spike in outbound DNS traffic, especially with unusually large query sizes or frequent requests to suspicious domains, is a direct indicator of data being fragmented and transmitted out of the network via this covert channel.
- ✗
A keylogger that sends captured keystrokes via HTTP
Why it's wrong here
A keylogger is designed to capture user keystrokes and other input, typically for credential theft or espionage. When configured to exfiltrate this captured data via HTTP, the tool would primarily generate outbound traffic over TCP port 80 or 443 (HTTPS) to a command-and-control server. While initial DNS lookups would occur to resolve the C2 domain, the continuous data transmission itself would manifest as HTTP traffic, not a sustained or unusual spike in outbound DNS queries.
Go deeper
Related to this question
About these practice questions
One of 870 original CEH practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CEH practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CEH exam.